Amberlo Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

We have created Amberlo to provide better access to justice. Like any other technology, Amberlo is not perfect. Therefore we aim to work with the leading security researchers worldwide to strengthen Amberlo app security.

Please inform us about any security issues, and we will make sure that we fix them promptly in collaboration with you.

While researching, we'd like to ask you to avoid the following:
* Denial of service attacks
* Spamming
* Social engineering (including phishing) of Amberlo staff or contractors
* Any physical attempts against Amberlo property or data centers

Thank you for helping keep the Amberlo app and our users safe!

Testing Requirements:

We have mirrored our production environment and created new environment for testing at test.amberlo.io. Please use test.amberlo.io while researching, but try to avoid anything that would result in an extreme load on the prepared test environment.

Possible Awards:

Amberlo offers a monetary bounty for reports of qualifying security vulnerabilities. Reward amounts will vary based on the severity of the reported vulnerability and agreed upon case by case.